3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc

General

Target
3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc
Size 1.8MB
Sample260708-jtkd2acy6w
SHA256 3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc
MD5 c9f1a6a851b43f6375e06ffb424cbd57
SHA1 434937a313125725b6740121b2d4fce56243f23b
SHA512 bceca081e14f69a6f79203bd4480d470d17ad7dec2fd3e1776d0ddbb7176b72ffcb2e3e0897ef9661e5aa3c1a650afbe29490d4bd2d6aee8d23c4471010fc87e
SSDEEP 12288:nGp+Y6TRTgRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nGSNT2dCN/j2GLl3iFSE33b9
TLSH
T1C585F1207A80D0F2DD2709354DEB9B759629BDE08B2075CB9B84FEEACA757D19731203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc

File Explorer

3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc

.exe 1.8MB

3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc

IMPHASH 1b10929fcf1c76dae560997be9573b32
SHA256 3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc
MD5 c9f1a6a851b43f6375e06ffb424cbd57
SHA1 434937a313125725b6740121b2d4fce56243f23b
SHA512 bceca081e14f69a6f79203bd4480d470d17ad7dec2fd3e1776d0ddbb7176b72ffcb2e3e0897ef9661e5aa3c1a650afbe29490d4bd2d6aee8d23c4471010fc87e
SSDEEP 12288:nGp+Y6TRTgRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nGSNT2dCN/j2GLl3iFSE33b9
TLSH
T1C585F1207A80D0F2DD2709354DEB9B759629BDE08B2075CB9B84FEEACA757D19731203
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

39488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA WriteProcessMemory InitializeProcThreadAttributeList ResumeThread OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep UpdateProcThreadAttribute GetFileAttributesA Process32NextW Process32FirstW CloseHandle HeapAlloc QueueUserAPC VirtualAllocEx GetProcessHeap CreateProcessA WriteConsoleW HeapSize CreateFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SetEndOfFile

user32

SystemParametersInfoW

Name

.text

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.6MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc

kernel32

user32

generic